Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 05 Jul 2013 20:22:02 -0700
From: Alan Coopersmith <>
CC: Kurt Seifried <>,,
        Sebastian Krahmer <>
Subject: Re: Question about CVE for X!! DoS

On 07/ 5/13 01:50 PM, Kurt Seifried wrote:
> Hash: SHA1
> Lists no CVE? I assume it needs one, or did upstream handle this?

Upstream discussion, including reps from both Red Hat & SuSE, determined
it didn't need a CVE, since it can only be triggered by a client authorized
to connect to the Xserver (via xauth, xhost, etc.) and such a client, by
design, can lock all other clients out from the server, kill clients, etc.

It would be like wanting a CVE for the fact that another process running
under your UID can kill your process.

Not sure why SuSE decided to go ahead and release it as a security fix
anyway - it's certainly a bug fix though.

	-Alan Coopersmith-    
	 Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.